We are creating a dashboard that shows us number of exception on a given system over a time window - specifically, the last 24 hours. The graph looks like this:
If you look closely though, the last bar is a day ago, and not today (See time generated on the last bar in the graph - 12/08/2022, but today is 12/09/2022).
This also occurring on some of our other graphs. Is there someway to get the dashboard to understand that this is a timeline, and always show the right most entry as "Now"? This is quite misleading - we ended up spending a bit of time trying to figure out why the issue wasn't solved. Turns out it was.
Reason why it is happening is because there have been no exceptions that happened since the last error (Yesterday).
Kusto query looks like this:
AppExceptions
| order by TimeGenerated desc
| where Properties.MS_FunctionName in ("WebhookFlow")
| summarize Exceptions=count() by bin(TimeGenerated, 15m)
| render columnchart with (title="Webhook exceptions")
CodePudding user response:
make-series operator
AppExceptions
| where Properties.MS_FunctionName in ("WebhookFlow")
| make-series Exceptions=count() on TimeGenerated from bin(ago(1d), 15m) to now() step 15m
| render columnchart with (title="Webhook exceptions")
CodePudding user response:
The bin function doesn't create empty bins for the 15m intervals where no exceptions occurred. A solution could be to make a projection that contains at least one element per 15m, so that bin can pick it up. The next problem is that count()
no longer yields the number of exceptions, so you might want to use a different aggregator, like sum(x)
.
As an example you could do something like this:
AppExceptions
| order by TimeGenerated desc
| where Properties.MS_FunctionName in ("WebhookFlow")
| project TimeGenerated, Count = 1
| union (
range x from 1 to 1 step 1
| mv-expand TimeGenerated=range(now()-24h, now(), 15m) to typeof(datetime)
| extend Count=0
)
| summarize Exceptions=sum(Count) by bin(TimeGenerated, 15m)
| render columnchart with (title="Webhook exceptions")